Ceplin Command Identifier

Identifier / Programs / Windows

wfmformat.exe

LOLBAS Execute 1 ATT&CK technique 1 documented command

Opens the identifier with your command. It is read in your browser and sent nowhere.

How wfmformat.exe is abused

documented by LOLBAS

Execute T1127 Trusted Developer Utilities Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wfmformat.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1127 Trusted Developer Utilities Proxy Execution User privileges

Executes the file tracerpt.exe in the same folder as WFMFormat.exe. If the file dumpfile.txt (any content) exists in the current working directory, no arguments are required. Note that WFMFormat.exe requires .NET Framework 3.5.

WFMFormat.exe
Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wfmformat.exe, by Tim Baker, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wfmformat.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
T1127Trusted Developer Utilities Proxy Execution

Other programs abused for Execute

acccheckconsole.exe · addinutil.exe · adplus.exe · advpack.dll · agentexecutor.exe · appcert.exe · applauncher.exe · appvlp.exe · at.exe · atbroker.exe · bash.exe · bginfo.exe · bitsadmin.exe · cdb.exe · certoc.exe · change.exe